Analysis
-
max time kernel
40s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 04:51
Static task
static1
Behavioral task
behavioral1
Sample
36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
Resource
win10v2004-20220414-en
General
-
Target
36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
-
Size
1.5MB
-
MD5
a790e22c9f0a53719daee116f0da2b60
-
SHA1
ced86c613a7c5f171788ca38eafb9085f2643229
-
SHA256
36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e
-
SHA512
834929d198ab0613cfb786e13e0f307032f13bdc47131e9358efc4c0bbc8ffc10aa2a12efd539d0f6336b4b6e21534811a3747be4f04df6abea09c1df613b7be
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exedescription ioc process File opened (read-only) \??\I: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\M: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\O: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\Q: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\S: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\X: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\W: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\E: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\G: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\J: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\N: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\R: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\U: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\H: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\K: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\L: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\V: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\F: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\P: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe File opened (read-only) \??\T: 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/324-54-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB